Application Security Lead — Build Secure AI, APIs & Apps

Tower; Auckland; Hybrid; NZD 140,000 - 200,000; Full time

Benefits offered by this job

26 weeks parental leave

Birthday off

22 days annual leave

Wellness leave

Career growth opportunities

Flexible working

Office in Auckland

Discounts on Tower products

Free life insurance

Job summary

Tower is seeking an experienced application security professional to shape how security is built into software from the start. You will drive secure-by-design practices across the SDLC, defend APIs and AI workloads, and partner with engineers to deliver secure and resilient applications.

The role emphasizes an adversarial mindset, threat modelling, and collaboration with engineering teams to remediate vulnerabilities and raise secure coding standards. Flexible working in Auckland is offered.

Qualifications

• 5+ years hands-on application security experience with adversarial mindset.
• Experience across threat modelling, API security and secure CI/CD pipelines.
• Familiarity with SAST, DAST, SCA and secret-scanning tools.
• Knowledge of OWASP Top 10 and GenAI/LLM security concepts.

Responsibilities

• Lead the Secure Software Development Lifecycle and embed secure-by-design practices.
• Identify and validate security risks across applications, APIs and AI workloads.
• Partner with developers to deliver secure and resilient solutions.

Skills

Application security

Penetration testing

Red teaming

Threat modelling

API security

Secure SDLC

CI/CD security

OWASP Top 10

GenAI security

LLM security

MITRE ATLAS

Security automation

Education

Relevant certifications (OSCP, OSWE, GWAPT, CSSLP)

Tools

Azure/Entra ID

Terraform

SAST/DAST tools

SCA/secret scanning tools

Job description

Tower is seeking an experienced application security professional to shape how security is built into software from the start. You will drive secure-by-design practices across the SDLC, defend APIs and AI workloads, and partner with engineers to deliver secure and resilient applications.

The role emphasizes an adversarial mindset, threat modelling, and collaboration with engineering teams to remediate vulnerabilities and raise secure coding standards. Flexible working in Auckland is offered.